CVE-2011-3372

Related Files

Red Hat Security Advisory 2011-1508-01

Posted Dec 1, 2011

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-1508-01 - The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support. An authentication bypass flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to read or post newsgroup messages on an NNTP server configured to require user authentication, without providing valid authentication credentials. A NULL pointer dereference flaw was found in the cyrus-imapd IMAP server, imapd. A remote attacker could send a specially-crafted mail message to a victim that would possibly prevent them from accessing their mail normally, if they were using an IMAP client that relies on the server threading IMAP feature.

tags | advisory, remote, imap

systems | linux, redhat

advisories | CVE-2011-3372, CVE-2011-3481

SHA-256 | 6b3205303af6886661268ac79f893acb0064e876132277e16c652b3953622d34

Download | Favorite | View

Mandriva Linux Security Advisory 2011-149

Posted Oct 15, 2011

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-149 - Multiple vulnerabilities has been discovered and corrected in cyrus-imapd. Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command. Secunia Research has discovered a vulnerability in Cyrus IMAPd, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to an error within the authentication mechanism of the NNTP server, which can be exploited to bypass the authentication process and execute commands intended for authenticated users by sending an AUTHINFO USER command without a following AUTHINFO PASS command.

tags | advisory, remote, overflow, arbitrary, vulnerability, imap

systems | linux, mandriva

advisories | CVE-2011-3208, CVE-2011-3372

SHA-256 | 1191292753cdb7c648b6f3c0d5659116f9b45499232eebda2c0efc795d775ec9

Download | Favorite | View

Debian Security Advisory 2318-1.txst

Posted Oct 7, 2011

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2318-1 - Multiple security issues have been discovered in cyrus-imapd, a highly scalable mail system designed for use in enterprise environments.

tags | advisory

systems | linux, debian

advisories | CVE-2011-3372, CVE-2011-3208

SHA-256 | 6aa0ec325a5be815c81bb67feae0cefdc3e2781d9482a41e3105fe41139fed85

Download | Favorite | View